diff mbox series

[6/8] firmware: meson_sm: make reg_write callback take const void *

Message ID 20260715175229.24672-7-linkmauve@linkmauve.fr (mailing list archive)
State New
Headers
Series nvmem: make reg_write() take a const void * |

Commit Message

Link Mauve July 15, 2026, 5:52 p.m. UTC 
The previous commit switched from a pointer to mutable data to a pointer
to immutable data, so let’s fix all users of the nvmem_config API.

Signed-off-by: Link Mauve <linkmauve@linkmauve.fr>
---
 drivers/firmware/meson/meson_sm.c       | 2 +-
 include/linux/firmware/meson/meson_sm.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

Comments

sashiko-bot@kernel.org July 15, 2026, 6:06 p.m. UTC | #1 
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Concurrent calls to `meson_sm_call_write` or `meson_sm_call_read` will corrupt the shared IOMEM buffer.
--

--- Patch [6]: [PATCH 6/8] firmware: meson_sm: make reg_write callback take const void * ---
commit 05903fc223bec5b04f497c8b4bf66c4c6d90ebfe
Author: Link Mauve <linkmauve@linkmauve.fr>

firmware: meson_sm: make reg_write callback take const void *

This commit updates the meson_sm_call_write callback and its header
declaration to take a const void * buffer. This aligns with a previous
change to the nvmem_config API that switched from a mutable to an
immutable data pointer.

> diff --git a/drivers/firmware/meson/meson_sm.c b/drivers/firmware/meson/meson_sm.c
> index ab9751a59b552..5d4da2e3c3a94 100644
> --- a/drivers/firmware/meson/meson_sm.c
> +++ b/drivers/firmware/meson/meson_sm.c
> @@ -196,7 +196,7 @@ EXPORT_SYMBOL(meson_sm_call_read);
>   *
>   * Return:	size of sent data on success, a negative value on error
>   */
> -int meson_sm_call_write(struct meson_sm_firmware *fw, void *buffer,
> +int meson_sm_call_write(struct meson_sm_firmware *fw, const void *buffer,
>  			unsigned int size, unsigned int cmd_index, u32 arg0,
>  			u32 arg1, u32 arg2, u32 arg3, u32 arg4)
>  {

[ ... ]

>  	memcpy(fw->sm_shmem_in_base, buffer, size);
>  
>  	if (meson_sm_call(fw, cmd_index, &written, arg0, arg1, arg2, arg3, arg4) < 0)
>  		return -EINVAL;

[Severity: High]
This isn't a bug introduced by this patch, but does this function need
locking to protect the shared IOMEM buffer?

It appears that concurrent calls to meson_sm_call_write() or
meson_sm_call_read() could corrupt the shared sm_shmem_in_base and
sm_shmem_out_base buffers. If multiple threads concurrently write or read
the nvmem sysfs files, they might overwrite each other's payloads before
the SMC executes, sending corrupted data to the Secure Monitor.

A similar pattern exists in meson_sm_call_read():

	if (buffer)
		memcpy(buffer, fw->sm_shmem_out_base, size);

Are there external locks that guarantee serialized access to these functions,
or should we be synchronizing these shared memory operations?
diff mbox series

Patch

diff --git a/drivers/firmware/meson/meson_sm.c b/drivers/firmware/meson/meson_sm.c
index ab9751a59b55..5d4da2e3c3a9 100644
--- a/drivers/firmware/meson/meson_sm.c
+++ b/drivers/firmware/meson/meson_sm.c
@@ -196,7 +196,7 @@  EXPORT_SYMBOL(meson_sm_call_read);
  *
  * Return:	size of sent data on success, a negative value on error
  */
-int meson_sm_call_write(struct meson_sm_firmware *fw, void *buffer,
+int meson_sm_call_write(struct meson_sm_firmware *fw, const void *buffer,
 			unsigned int size, unsigned int cmd_index, u32 arg0,
 			u32 arg1, u32 arg2, u32 arg3, u32 arg4)
 {
diff --git a/include/linux/firmware/meson/meson_sm.h b/include/linux/firmware/meson/meson_sm.h
index 3ebc2bd9a976..92cc61f3a1c0 100644
--- a/include/linux/firmware/meson/meson_sm.h
+++ b/include/linux/firmware/meson/meson_sm.h
@@ -21,7 +21,7 @@  struct meson_sm_firmware;
 
 int meson_sm_call(struct meson_sm_firmware *fw, unsigned int cmd_index,
 		  s32 *ret, u32 arg0, u32 arg1, u32 arg2, u32 arg3, u32 arg4);
-int meson_sm_call_write(struct meson_sm_firmware *fw, void *buffer,
+int meson_sm_call_write(struct meson_sm_firmware *fw, const void *buffer,
 			unsigned int b_size, unsigned int cmd_index, u32 arg0,
 			u32 arg1, u32 arg2, u32 arg3, u32 arg4);
 int meson_sm_call_read(struct meson_sm_firmware *fw, void *buffer,